empty arrays suck
factored out some auth